PT-2023-14569

CVE-2022-4492

Published

2023-02-23

Updated

2025-03-12

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description The undertow client does not check the server identity presented by the server certificate in https connections, which is a compulsory step that should be performed by default in https and http/2. This issue affects the TLS client protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Sandipan Roy

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers

CVE-2022-4492

GHSA-PFCC-3G6R-8RG8

RHSA-2023:1512